The cohort that posted twice
- What
- Cohort 3 posted 212 ledger lines twice for nine minutes during the cutover.
- Cause
- A consumer replayed an offset after a partition rebalance, and the posting call was not idempotent.
- Cost
- Three hours of cleanup and reconciliation. No money moved: payments were still gated by the batch.
- Changed
- Every posting carries an idempotency key. Each cohort starts with a replay drill on a copy.